Privacy

1. Who is responsible for your data

This is self-hosted software. The organisation or person who installed and runs this deployment is the data controller — legally responsible for the personal data in it, and the party you exercise any rights against. The authors of the software are not: they have no access to this database and no copy of it.

The operator publishes their identity and contact address on the contact page. If that page has no address yet, the operator has not finished setting this deployment up.

2. What is stored when you have an account

Profile

Your email address, a display name, a username, and a language preference. Nothing else is asked for, and there are no optional profile fields collecting more.

Password

Never stored. What is stored is an Argon2id hash, which cannot be turned back into your password. Password reset and email verification tokens are stored as hashes too.

Sessions

One record per signed-in browser: when it was created, when it was last used, the browser’s user-agent string, and a salted hash of a truncated form of your IP address — the first 24 bits for IPv4, the first 48 for IPv6. The address itself is not stored. You can see this list and end any session in your account settings.

Audit entries

Security-relevant actions — signing in, changing a password, moderation decisions, membership changes — are appended to a log that is never edited or deleted. It records who did what and when.

3. Cookies

Two cookies, both first-party, both set only when you sign in. There is no cookie for reading, no consent banner, and no third-party cookie of any kind.

• typeline_session — an opaque session token. HttpOnly, so JavaScript cannot read it, SameSite=Lax, and marked Secure whenever the deployment is served over HTTPS. Only a hash of it is kept on the server.
• typeline_csrf — the browser-readable half of a double-submit pair that stops another site from acting as you. Readable by design; it authorises nothing on its own.

Both last 30 days, and a session that goes unused for 14 days expires regardless. Signing out clears them; signing out everywhere ends every session on every device.

4. What you write and upload

Publications, posts, revisions, categories and uploaded media are stored so the platform can do what you asked. Revisions are immutable and are kept, which is the point of having them: an old draft can be recovered because nothing overwrote it.

Two details about uploads worth knowing:

• Camera and location metadata is removed from images. EXIF, XMP and embedded comments are stripped on upload; orientation is applied to the pixels first so the picture still looks right, and the colour profile is kept because it describes colour, not the photographer. PDFs and plain-text files are stored as you uploaded them — their internal metadata is not stripped, so check a PDF before publishing it.
• The filename you uploaded is stored alongside the file. If a filename would say something you would rather it did not, rename it before uploading.

5. Readers and analytics

Reading an article requires no cookie, no account and no JavaScript. The platform has its own analytics rather than a third party’s, and they are built so that the interesting question — “how many people read this?” — can be answered without keeping anything that identifies a person.

When a view is recorded, this is the complete set of fields stored:

• which publication and which post;
• a visitor key — see below;
• the host of the site you arrived from, never the full referring URL, and never at all when you navigated within the same site;
• a two-letter country code, but only if the operator’s edge supplies one. The platform ships no IP-to-location database, so on a default deployment this stays empty;
• a coarse device class — desktop, mobile, tablet or bot — derived from the user-agent string, which is itself not stored;
• the event type, and for read-depth events an approximate number of seconds.

There is no URL, no query string, no user-agent string, no screen size, no session identifier and no account identifier in that row.

Your IP address is never stored. It is used for a moment, in memory, together with your user-agent and a secret salt, to compute a shortened SHA-256 hash — the visitor key. The salt is random, it is replaced every UTC day, and old salts are deleted after two days. Once a salt is gone nobody can recompute the keys that were made with it, including the operator. That is the mechanism, and its consequence is the honest limit of these numbers: “unique readers” means unique within one day, and no one can join yesterday’s readers to today’s.

Nothing follows you. No analytics cookie. No local storage. No fingerprinting, no behavioural scoring, no cross-site identifier. No Google Analytics, no Segment, no advertising pixel — the content security policy would block one even if somebody added it, and no web font is fetched from anyone else’s servers.

If your browser runs JavaScript, reaching a quarter, half, three quarters or the end of an article can send a small message containing the post identifier, the milestone name and a rounded time on the page. It contains no identifier, no URL and no referrer, and the article is complete without it.

6. How long anything is kept

Individual analytics events

90 days, then deleted.

Daily totals per post

Two years. These are counts only — no visitor key survives into them, so they cannot be traced back to anyone.

Analytics salts

Two days. Kept for a second day only so an event that crosses UTC midnight still hashes consistently.

Sessions

30 days at most, and 14 days of inactivity ends one sooner.

Posts, revisions and media

Until you delete them.

Audit log

Append-only, and kept for as long as the operator keeps the deployment.

7. Email we send you

Four messages, all plain text, none containing a tracking pixel or a wrapped link: confirm your email address, reset your password, your password was changed, and your account deletion is scheduled. There is no marketing list to be added to and no newsletter to unsubscribe from.

Invitations to join a publication are not emailed. The invitation link is shown once to the person who created it, and they pass it on themselves.

Mail leaves through whatever SMTP server the operator configured, which means their mail provider handles it. Ask them which one if it matters to you.

8. Who else sees any of this

Nobody, by default. The core platform makes no calls to third-party services: no analytics vendor, no error-reporting service, no font or script CDN, no advertising network. Everything runs inside the deployment — its own database, its own object storage, its own image processing.

What is outside the operator’s machines is the operator’s choice: their hosting, their SMTP provider, and — if they put one in front of the platform — their CDN. Their contact page is where to ask.

The platform does fetch a URL you paste as an embed, in order to show a preview. Those requests are made through a fetcher that refuses to connect to private, loopback or cloud-metadata addresses, and the site you linked to sees a request the same way it would see any other.

9. What you can do

• See and change your profile in account settings — display name, username, language.
• See every signed-in session and end any of them, or all of them at once.
• Delete anything you published. Posts can be unpublished, archived or deleted.
• Request account deletion from account settings. It asks for your password first.

Be aware of exactly what deletion does today, because it is less than the word suggests. It marks the account for removal, ends every session, invalidates every outstanding email link, blocks sign-in, and records a 30-day window. It does not yet erase the rows automatically — there is no purge job running on that schedule, so the final removal is something the operator performs. If you need confirmation that your data is gone, ask them and get an answer rather than assuming.

Where the law where you live gives you further rights — access, correction, portability, objection, complaint to a supervisory authority — the operator is who you exercise them against.

10. Changes to this notice

The date at the top is when this was last changed. When the platform starts collecting or keeping something new, this page changes first, not afterwards.